Configure
Cipher suite lookup
Search TLS cipher suites by IANA name, OpenSSL name or hex code and see what each one uses and how secure it is.
Cipher suite lookup translates between the names TLS cipher suites go by and shows what each one is made of. Type an IANA name such as TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, an OpenSSL name such as ECDHE-RSA-AES128-GCM-SHA256, or a hex code such as 0xC0,0x2F, and the matching suites appear with their key exchange, authentication, cipher, MAC, TLS versions and rating.
How to use it
- Type part of a name or a hex code into the search box. Results update as you type.
- Filter by TLS version or rating if the list is long.
- Click a suite's IANA name for its detail page.
Reading a cipher suite name
A TLS 1.2 name lists four parts. TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 means: ECDHE key exchange (forward secrecy), RSA certificate for authentication, AES-128 in GCM mode for encryption (AEAD), and SHA-256 for the handshake PRF.
TLS 1.3 names such as TLS_AES_128_GCM_SHA256 only name the AEAD cipher and hash: key exchange (for example X25519 or the post-quantum hybrid X25519MLKEM768) and the certificate type are negotiated separately.
What the ratings mean
Suites with forward-secret key exchange and AEAD encryption are the current recommendation (RFC 9325). CBC-mode suites and RSA key exchange are legacy: still found on old servers, not needed by current clients. RC4, 3DES, export and NULL suites are insecure and should be disabled. To build a configuration that enables only good suites, use the TLS config generator.
FAQ
How do I convert an OpenSSL cipher name to the IANA name?
Search for the OpenSSL name here, or run openssl ciphers -stdname -V on a system with OpenSSL: it lists both names and the hex code for every suite your OpenSSL supports.
Which cipher suites should I enable?
For TLS 1.3, the defaults. For TLS 1.2, ECDHE key exchange with AES-GCM or ChaCha20-Poly1305 only, as in the intermediate profile of the TLS config generator. Avoid CBC, RC4, 3DES and static RSA key exchange.
What does the hex code mean?
It is the two-byte identifier sent in the ClientHello and ServerHello. Packet captures and some logs show only this code, so the lookup accepts formats such as 0x13,0x01, 0x1301 and 1301.